D.C. Circuit Upholds Bitcoin Fog Operator’s Conviction

The D.C. Circuit upheld Roman Sterlingov’s conviction and 150-month sentence for operating Bitcoin Fog, a service that mixed users’ bitcoin to make transaction trails harder to follow. The court allowed proprietary wallet-tracing evidence from Chainalysis’s Reactor software to remain in the case.

FBI witness Luke Scholl and Chainalysis analyst Elizabeth Bisbee testified that Reactor clustered and attributed more than 900,000 Bitcoin addresses to Bitcoin Fog. Their analysis used several types of inference, including addresses used together in transactions, transaction patterns, change-address behavior, data leaks, court records and other intelligence sources.

The appeals court found that the testimony met the reliability requirements for expert evidence under Federal Rule of Evidence 702. The rule requires expert testimony to help the court or jury, rely on sufficient facts or data, use reliable methods and apply those methods reliably to the case.

Reactor had not been peer-reviewed, and the witnesses did not know its error rate. The court nevertheless cited their experience, explanations of the software’s methods, its use by law enforcement and private-sector specialists, comparisons with information later obtained through legal processes and other supporting evidence.

That evidence included IP-address overlaps, Sterlingov’s earlier activity involving mixers and darknet promotion, financial records and Bitcoin Fog’s shutdown shortly after his arrest. In one test, Reactor placed four of five known Bitcoin Fog addresses in the service’s cluster. Sterlingov treated the result as a 20% error rate. The court accepted the trial judge’s explanation that the software was conservative and could miss relevant addresses without wrongly assigning unrelated addresses.

The opinion also referred to a government contractor’s finding that Reactor correctly clustered and attributed 99.9% of a large group of addresses in another case. The court did not establish that figure as a general error rate for all Reactor analyses.

The district court ordered Chainalysis to provide Sterlingov’s lawyers and qualified experts with Reactor’s heuristics and underlying assumptions under a protective order. Sterlingov’s personal access was restricted because the information could potentially help someone evade tracing methods. The appeals court noted that his experts declined to review the disclosed materials regardless of the protective order’s scope.

The court distinguished access to Reactor’s methods from access to the software’s full source code. It said the district court had repeatedly asked Sterlingov to explain why the code was relevant and material to his defense, but he had not done so. The trial court had indicated that it could consider releasing the code if a specific need were established.

The appeals court rejected Sterlingov’s argument that the Confrontation Clause required disclosure because Reactor generated some of the evidence. It also found that several constitutional arguments about full access to the software had been raised too late. Sterlingov did not show that withholding the code materially impaired his defense.

Chainalysis discussed the ruling in company commentary published Oct. 13, presenting it as support for Reactor’s use in investigations and court proceedings. The decision addressed the admissibility of the testimony and Sterlingov’s disclosure request; it did not determine Reactor’s error rate across all cases.

Bitcoin tracing can link addresses to a service without proving that the service operator owned every bitcoin held at those addresses. Earlier research has noted that wallet services can control addresses containing funds belonging to different customers. The court therefore treated service attribution, personal ownership and identification of an operator as separate issues.